Paycheck Protection Program

Summary

SBA Office of the Chief Information Officer Privacy Impact Assessment for the Paycheck Protection Program, dated April 3, 2020, marked Controlled Unclassified Information. Its approval page shows digital signatures by Nagesh Rao, Director of BiTS and System Owner, and Maria Roat, Chief Information Officer and Senior Agency Official for Privacy. The assessment was completed by Jesse Carstens, Information System Security Officer, with LaWanda Burnette as Reviewing Analyst. It then answers standard questions about the Paycheck Protection Program system and the information it collects.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Small Business Administration
409 3rd Street, S.W.
Washington, DC 20416

Office of the Chief Information Officer

Paycheck Protection Program

Privacy Impact Assessment

April 3, 2020
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

Document Information

Template Owner Details
Name James L. Saunders
Contact Number 202-609-7980
E-mail Address James.Saunders@sba.gov

Privacy Impact Assessment (PIA) Approval Page

The following individuals have approved this document:

1) System Owner

G RAO
Digitally signed by G RAO
Date: 2020.04.06 14:34:45
-04'00' (Signature) (Date)

Name: Nagesh Rao
Title: Director of BiTS
Office of the Chief Information Officer

2) Senior Agency Official for Privacy

MARIA ROAT Digitally signed by MARIA ROAT
Date: 2020.04.06 11:23:55 -04'00'
(Signature) (Date)

Name: Maria Roat
Title: Chief Information Officer
Senior Agency Official for Privacy
Office of the Chief Information Officer

PAGE 2 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

A. CONTACT INFORMATION

1) Who is the person completing this document?

Jesse Carstens, Information System Security Officer
Office of the Chief Information Officer
Jesse.Carstens@sba.gov

2) Who is the system owner?

Nagesh Rao, System Owner, Director of BiTs
Office of the Chief Information Officer
Nagesh.rao@sba.gov

3) Who is the Reviewing Analyst?

LaWanda Burnette
Office of the Chief Information Officer
LaWanda.Burnette@sba.gov

B. SYSTEM APPLICATION/GENERAL INFORMATION

The Paycheck Protection Program (PPP) is an application hosted on SBA.gov (https://www.sba.gov/).
SBA.gov is the primary website for the U.S. Small Business Administration (SBA). The PPP was
created as a result of the COVID-19 crisis offering forgivable loans to small business. Users submit a
PPP application form, SBA Form 2481, OMB Control number 3245.

The SBA.gov is hosted on Amazon Web Services (AWS) – US East. Public users can access SBA.gov
through a web-browser from any remote location with Internet access

1) Does this system contain any information about individuals? If yes, explain.

Yes, the PPP contains the following information:

o Name (last, first, middle)
o Tax Identification/Social Security Number or Employer Identification Number
o Email address
o Physical address
o Telephone number
o Citizenship status
o Alien Registration Number
o Race
o Ethnicity
o Gender
o Loan Agent information: (name, address, loan number, financial information, loan amount)
o Judicial information
o Signature

PAGE 3 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

a. Is the information about individual members of the public?

Yes.

b. Is the information about employees?

Potentially yes

2) What is the purpose of the system/application?

The SBA.gov is the primary website for the SBA. The SBA.gov incorporates online tools and
features to deliver information and services to lenders, SBA partners, small business owners and
prospective small business owners. SBA.gov enables small businesses to gain necessary access to
the capital and tools they need to drive economic recovery and to create and retain jobs. SBA.gov
is a public facing website.

3) Is the system in the development process?

4) How will the technology investment (new or updated) affect existing privacy processes?

No impact at this time.

5) What legal authority authorizes the purchase or development of this system/application?

o Debt Collection Act of 1982, Deficit Reduction Act of 1984 (31 U.S.C. 3701
o Right to Financial Privacy Act of 1978 (12 U.S.C. 3401)
o Debarment and Suspension Executive Order 12549; (2 CFR Part 180 and Part 2700
o 15 U.S.C. § 634(b)(6), 44 U.S.C. § 3101.
o Section 7(b)(1) of the Small Business Act, as amended, authorizes the Agency's Physical
Disaster Loan Program
o Section 7(b)(2) of the Small Business Act, as amended, authorizes the Agency's Economic
Injury Disaster Loan (EIDL) Program
o Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020.

6) Privacy Impact Analysis: What privacy risks were identified and describe how they were
mitigated for security and access controls?

Office of Management and Budget (OMB) Memorandum 17-12 (M-17-12), identifies risks of
disclosure of individuals’ privacy data in five major areas. The table below identifies those risk
areas and the mitigating strategies for each.

Potential Risk Mitigating Strategies
Sensitivity of Data Elements Sensitivity of PPP data is mitigated using access
controls, auditing, masking and monitoring.
Context of the Data PPP data about individuals is mitigated through

PAGE 4 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

Revelation of Private Information The maximum extent to which private information
could be disclosed address, race, and ethnicity of the
participant, which is mitigated through access
enforcement, auditing, and monitoring.
Impact on Vulnerable Populations Disclosure of PPP data may adversely affect specific
vulnerable population.
Relevance of the Data Over Time Relevance of PPP data would not be significantly
affected over time.

C. SYSTEM DATA

1) What categories of individuals are covered in the system?

The PPP gathers data about business owners, individuals, non-profits, tribal, that are looking for
lenders to provide payroll protection program relative to COVID-19.

2) What are the sources of the information in the system?

a. Is the source of the information from the individual or is it taken from another
source? If not directly from the individual, then what other source?

All information is obtained through participating individual.

b. What Federal agencies are providing data for use in the system?

None.

c. What Tribal, State and local agencies are providing data for use in the system?

Can be potential applicants.

d. From what other third-party sources will data be collected?

None

e. What information will be collected from the employee and the public?

Please see section B, 1) above.

3) Accuracy, Timeliness, and Reliability

a. How is data collected from sources other than SBA records verified for accuracy?

PPP relies on the participating individual for data validation. In addition there are
validation checks via financial institution authorization code.

b. How is data checked for completeness?

PPP relies on the participating individual for data validation and incomplete applications
cannot be processed.

PAGE 5 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

c. Is the data current?

PPP relies on the participating individual to provide current information. The
participating individual can update their information at any time.

d. Are the data elements described in detail and documented?

Yes, PPP has a database dictionary and spreadsheet with data variables defined.

4) Privacy Impact Analysis: Discuss what privacy risks were identified and how they were
mitigated for the types of information collected?

Potential Risk Mitigating Strategies
Sensitivity of Data Elements Sensitivity of PPP data is mitigated using access
controls, masking, auditing, and monitoring.
Context of the Data PPP data about individuals has levels of protection to
safeguard information.
Revelation of Private Information The maximum extent to which private information
could be disclosed address, race, and ethnicity of the
participant, which is mitigated through access
enforcement, auditing, and monitoring.
Impact on Vulnerable Populations Disclosure of PPP data would may adversely affect any
specific vulnerable population.
Relevance of the Data Over Time Relevance of PPP data would not be significantly
affected over time.

D. DATA ATTRIBUTES

1) Is the use of the data both relevant and necessary to the purpose for which the system is
being designed?

Yes, Same as B, 5) above.

2) Will the system derive new data or create previously unavailable data about an individual
through aggregation from the information collected, and how will this be maintained and
filed?

No.

3) Will the new data be placed in the individual’s record?

N/A.

PAGE 6 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

4) Can the system make determinations about employees or members of the public that would
not be possible without the new data?

N/A

5) How is the new data verified for relevance, timeliness and accuracy?

The PPP data is dependent on the user’s willingness to provide relevant, timely and accurate data.
The user can update his or her information at any time.

6) If the data is being consolidated, what controls are in place to protect the data from
unauthorized access or use?

PPP is not in the process of consolidating individuals’ data at this time. If information is used for
aggregated purposes, all PII will be redacted.

7) If processes are being consolidated, are the proper controls remaining in place to protect
the data and prevent unauthorized access? If processes are not being consolidated please
state, “N/A”.

N/A.

8) How will the data be retrieved? Does a personal identifier retrieve the data? If yes, explain
and list the identifiers that will be used to retrieve information on the individual.

N/A.

9) What kinds of reports can be produced on individuals? What will be the use of these
reports? Who will have access to them?

N/A.

10) What opportunities do individuals have to decline to provide information (i.e., where
providing information is voluntary) or to consent to particular uses of the information
(other than required or authorized uses), and how individuals can grant consent.

Participation with PPP is voluntary and specific for this crisis, COVID-19.

11) Privacy Impact Analysis: Describe any types of controls that may be in place to ensure that
information is used as intended.

Potential Risk Mitigating Strategies
Sensitivity of Data Elements Sensitivity of SBA.gov data is mitigated using access
controls, masking, auditing, and monitoring.
Context of the Data PPP data about individuals only has context with regard
to business demographic purposes.

PAGE 7 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

Revelation of Private Information The maximum extent to which private information
could be disclosed address, race, and ethnicity of the
participant, which is mitigated through access
enforcement, auditing, and monitoring.
Impact on Vulnerable Populations Disclosure of SBA.gov data may adversely affect any
specific vulnerable population.
Relevance of the Data Over Time Relevance of PPP data would not be significantly
affected over time.

1) What are the retention periods of data in this system?

No data is retained on SBA.gov, the data is transferred from PPP to the Capital Access Financial
System (CAFS) Etran. The FAR requires contract data to be retained for 6 years and 3 months.

2) What are the procedures for disposition of the data at the end of the retention period? How
long will the reports produced be kept? Where are the procedures documented?

Procedures for disposing data are executed in accordance with NIST SP 800-88 as amended.

3) Is the system using technologies in ways that the SBA has not previously employed (e.g.,
monitoring software, Smart Cards, Caller-ID)?

No.

4) How does the use of this technology affect public/employee privacy?

N/A.

5) Will this system provide the capability to identify, locate, and monitor individuals? If yes,
explain.

No.

6) What kinds of information are collected as a function of the monitoring of individuals?

N/A.

7) What controls will be used to prevent unauthorized monitoring?

Risks to unauthorized monitoring of privacy data were identified and broken into three major
categories, with associated mitigating strategies identified in the table below.

Potential Risk Mitigating Strategy
Loss of data confidentiality Role-based access control
Auditing on security-related events
Encryption of data in transit
Loss of data integrity Incremental and full backups
Data integrity checks
Loss of data availability Data redundancy
Contingency Planning

PAGE 8 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

8) Under which Privacy Act systems of records notice (SORN) does the system operate?
Provide number and name.

N/A.

9) If the system is being modified, will the Privacy Act system of records notice require
amendment or revision?

N/A.

F. DATA ACCESS

1) Who will have access to the data in the system? (e.g., contractors, users, managers, system
administrators, developers, tribes, other)

PPP administrators, owners, and contractors working on behalf of SBA.

2) How is access to the data by a user determined? Are criteria, procedures, controls, and
responsibilities regarding access documented?

Request process via PPP system owner and adjudication.

3) Will users have access to all data on the system or will the user’s access be restricted?
Explain.

No. Users will be restricted to their information only.

4) What controls are in place to prevent the misuse (e.g., unauthorized browsing) of data by
those having access? (Please list processes and training materials)

PPP is on the platform of SBA.gov which developed an Access Management Plan that addresses
all Access Controls and enforces the appropriate controls for the appropriate security level of the
system. Users who authorized to access the data will be controlled by the authorized role they are
assigned with their account.

5) Are contractors involved with the design and development of the system and will they be
involved with the maintenance of the system? If yes, were Privacy Act contract clauses
inserted in their contracts and other regulatory measures addressed?

Yes. Privacy Act clauses are in the contract.

6) Do other systems share data or have access to the data in the system? If yes, explain.

Yes, the data that is collected via PPP portal via SBA.gov and then sent over to Etran to be
maintained.

7) Who will be responsible for protecting the privacy rights of the public and employees
affected by the interface?

PAGE 9 OF 10
Controlled Unclassified Information
PRIVACY IMPACT ASSESSMENT PAYCHECK PROTECTION PROGRAM

System Owner, Information System Security Officer, and system administrators.

8) Will other agencies share data or have access to the data in this system via transferred or
transmitted (Federal, State, and Local, Other (e.g., Tribal))?

Yes, Preapproved Lenders that have lender agreements with SBA are matched with the user will
have access to the data.

9) How will the shared data be used by the other agency?

It will be used to provide loans to the users.

10) What procedures are in place for assuring proper use of the shared data?

The Lenders are approved and have a lender agreement with SBA.

11) Privacy Impact Analysis: Discuss what privacy risks were identified and how they were
mitigated for information shared internal and external.

Potential Risk Mitigating Strategies
Sensitivity of Data Elements Sensitivity of PPP data is mitigated using access
controls, masking, auditing, and monitoring.
Context of the Data PPP data about individuals only has context with regard
to business demographic purposes.
Revelation of Private Information The maximum extent to which private information
could be disclosed address, race, and ethnicity of the
participant, which is mitigated through access
enforcement, auditing, and monitoring.
Impact on Vulnerable Populations Disclosure of PPP data may adversely affect any
specific vulnerable population.
Relevance of the Data Over Time Relevance of PPP data would not be significantly
affected over time.

PAGE 10 OF 10
Controlled Unclassified Information

File and source

File: 2021-04_PPP_PIA_2020-04-03_0.pdf
Size: 371,298 bytes
SHA-256: e936bde8e6c6bf09d353348456983d705bbf93ca0fc409f617f88ba418710bb8
Our copy: 2021-04_PPP_PIA_2020-04-03_0.pdf
Original: www.sba.gov